Hi, we are using a Splunk Cloud ES and we can't seem to edit the base search macro of the "Alerts" datamodel. The macro in question is, " cim_Alerts_indexes" and it appears it has an extra parameter which generates an error when this macro is ran manually. Error: "Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side" And that is due to the fact that the macro SPL is set up as follows: (index=(index=azure_security sourcetype="GraphSecurityAlert") OR (index=trendmicro)) The extra "index=" in the beginning is what's messing it up. It should be removed. However, when we try to go to Settings -> Advanced Search and click on this macro, we are taken to the CIM Setup interface (Splunk_SA_CIM) which shows the config settings of the macro, including the: Indexes whitelist = azure_security,trendmicro
Tags whitelist = cloud, pci Notice, the editable configs do not include the definition which is: (index=(index=azure_security sourcetype="GraphSecurityAlert") OR (index=trendmicro)) So can anyone assist how we can correct this? Regards
... View more